453 matches found
Weak Password Vulnerability in Tianqing Hanma USG Firewall
Tianqing Hanma USG Firewall is a new firewall series product officially launched by Qixing. There is a weak password vulnerability in Tianqing Hanma USG Firewall. Attackers can use the default account to enter the management interface and obtain sensitive information...
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
Command injection
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
CVE-2020-29299
CVE-2020-29299 affects Zyxel SD-OS/On-Premise lines (VPN On-Premise, VPN Orchestrator, USG, USG FLEX, ATP, NSG). A command injection occurs via an admin-provided input string to chg_exp_pwd during a password-change action. Root cause stated in multiple sources: lack of input validation/cleanup in...
CVE-2020-29299
Certain Zyxel products allow command injection by an admin via an input string to chgexppwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38, VPN Orchestrator before SD-OS V10.03 week32, USG before ZLD V4.39 week38, USG FLEX before ZLD V4.55 week38, ATP before...
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...
Default credentials
Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...
CVE-2020-29583
Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges...
CVE-2020-29583 Zyxel USG Hard-Coded Admin Creds
Firmware version 4.60 of Zyxel USG devices contains an undocumented account zyfwp with an unchangeable password. The password for this account can be found in cleartext in the firmware. This account can be used by someone to login to the ssh server or web interface with admin privileges. Recent...
CVE-2020-29583
CVE-2020-29583 (Zyxel hard-coded credentials) The Zyxel vulnerability concerns an undocumented user account, “zyfwp,” with an unchangeable password found in the firmware of multiple Zyxel devices. The account can grant admin access via SSH or the web interface. Affected devices include Zyxel USG/...
U.S. Dept Of Defense: Sensitive information about a ██████
Summary: https://████████/ is an U.S. Government USG Information System IS that is provided for USG-authorized use only.Due to some reason a document which contains the information about a special ███ for the ████ █████ which possibly is ███████or █████.The pdf file is located at...
CVE-2020-9099
CVE-2020-9099 affects Huawei enterprise devices: IPS/NGFW modules and USG/NIP series (NIP6300/6600/6800; Secospace USG6300/6500/6600/USG9500) with specific V500R0xxC0x/v500R005C0x builds. The vulnerability is described as improper authentication that could allow an unauthenticated attacker to per...
Huawei Data Communication: Weak Algorithm Vulnerability in Huawei USG product (huawei-sa-20170802-01-usg)
There is a weak algorithm vulnerability in Huawei USGUSG6300/USG6600 products. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program ...
CVE-2020-1876
NIP6800;Secospace USG6600;USG9500 with versions of V500R001C30; V500R001C60SPC500; V500R005C00SPC100 have an out-of-bounds write vulnerability. An unauthenticated attacker crafts malformed packets with specific parameter and sends the packets to the affected products. Due to insufficient validati...
CVE-2020-1814
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a Dangling pointer dereference vulnerability. An authenticated attacker may do some special operations in t...
Design/Logic Flaw
Huawei NIP6800 versions V500R001C30, V500R001C60SPC500, and V500R005C00; Secospace USG6600 and USG9500 versions V500R001C30SPC200, V500R001C30SPC600, V500R001C60SPC500, and V500R005C00 have a vulnerability that a memory management error exists when IPSec Module handing a specific message. This...
Cross site scripting
A reflective Cross-site scripting XSS vulnerability in the freetimefailed.cgi CGI program in selected Zyxel ZyWall, USG, and UAG devices allows remote attackers to inject arbitrary web script or HTML via the errmsg parameter...
CVE-2019-12583
Missing Access Control in the "Free Time" component of several Zyxel UAG, USG, and ZyWall devices allows a remote attacker to generate guest accounts by directly accessing the account generator. This can lead to unauthorised network access or Denial of Service...
CVE-2019-12581
The CVE-2019-12581 issue affects Zyxel ZyWall, USG, and UAG devices, where the free_time_failed.cgi CGI is vulnerable to a reflective XSS via the err_msg parameter. The Nuclei template specifies that remote attackers can inject arbitrary web script or HTML, with the attack context limited to the ...